Windows 10 1607 Anniversary Update on gal.vin

Windows 10 1607/1703 Start Menu Customisation - Update

Thu, 30 Mar 2017 20:37:58 +0000

Here’s a quick update on an option I missed in my previous post about how to customise the Start Menu and Taskbar for new Windows 10 1607/1703 installs.

Update 2017-05-02: This also works with Windows 10 1703 (Creators Update) The method that I used in my previous post would not be suitable for other environments where you would still want users to have some control over apps that were pinned to the Start Menu. Although I don’t believe that the perfect solution, which would be to set a default Start Menu on login but then let users change it currently exists without some hacks, I have found an option that’s better than a full lockdown - partial lockdown.

Microsoft have a post all about it on TechNet here: https://docs.microsoft.com/en-gb/archive/blogs/deploymentguys/windows-10-start-layout-customization

To deploy a Partial Lockdown Start Menu, you would configure and export the Start Menu.xml configuration file you would want as normal with the Export-StartMenu cmdlet.

`1`	`Export-StartLayout C:\StartMenu.xml`

You will then need to open the XML file and find <DefaultLayoutOverride> near the top of the file and change it to:

`1`	`<DefaultLayoutOverride LayoutCustomizationRestrictionType="OnlySpecifiedGroups">`

Here’s an example partial lockdown XML file with both StartMenu and Taskbar customisation:

<?xml version="1.0" encoding="utf-8"?>
<LayoutModificationTemplate xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout" Version="1">
  <LayoutOptions StartTileGroupCellWidth="6" StartTileGroupsColumnCount="1" />
  <DefaultLayoutOverride LayoutCustomizationRestrictionType="OnlySpecifiedGroups">
    <StartLayoutCollection>
      <defaultlayout:StartLayout GroupCellWidth="6" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout">
        <start:Group Name="Browsers" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk" />
          <start:Tile Size="2x2" Column="2" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk" />
        </start:Group>
        <start:Group Name="Somethings" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk" />
        </start:Group>
        <start:Group Name="Comms" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk" />
        </start:Group>
      </defaultlayout:StartLayout>
    </StartLayoutCollection>
  </DefaultLayoutOverride>
    <CustomTaskbarLayoutCollection PinListPlacement="Replace">
      <defaultlayout:TaskbarLayout>
        <taskbar:TaskbarPinList>
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk" />
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk" />
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk" />
        </taskbar:TaskbarPinList>
      </defaultlayout:TaskbarLayout>
    </CustomTaskbarLayoutCollection>
</LayoutModificationTemplate>

A small caveat with this method is that the default apps and groups that are part of the default Windows 10 install will still be there, although the user can remove them and they will be below the apps and groups that you specify, which will also be locked and the user will not be able to change them.

I take great care to test my ideas and make sure my articles are accurate before posting, however mistakes do slip through sometimes. If you have any questions or comments, please leave them below.

I hope this article helps you out. Thank you.

-Mike

Deploying a Windows 10 1607 Reference Image with Microsoft Deployment Toolkit 8443

Sat, 21 Jan 2017 13:20:19 +0000

Continuing on from my previous post (Building a Windows 10 1607 Reference Image with Microsoft Deployment Toolkit 8443) I’ll be continuing my series of deploying Windows 10 1607 with Microsoft Deployment Toolkit build 8443. In this post we’ll be building a task sequence to deploy the reference image created previously and we’ll also be tackling domain joining, drivers, and post-imaging tasks.

Update 02/05/2017: Please note that this post is also relevant to Windows 10 1703 (Creators Update) with a few minor changes, which I’ve posted about here.

Creating the Deployment Task

These steps will create a Task Sequence that will:

Format the hard disk.
Install the Windows 10 1607 reference image.
Join a domain via a PowerShell script.
Install updates from a local WSUS server.

Go to Deployment Workbench > Deployment Share > Task Sequences.
Right click on Task Sequences and select New task sequence.
Enter a unique ID for the Task Sequence: DEP-REF-W101607.
Enter a unique name for the Task Sequence: Deploy - Reference W101607.
Select the Standard Client Task Sequence template.
Select REF-W101607 as the Operating System.
Select Do not specify a product key at this time to activate via a KMS server or use an evaluation license, otherwise use the other options to enter the applicable product keys.
Enter an Organization name.
Select Use the specified local Administrator password and enter the desired password.
Click Next > Next > Finish to complete the wizard.

Joining the Client to the Domain Using PowerShell.

MDT can perform a Domain Join action itself, but to keep things more manageable, here we’ll be using PowerShell. The script below was sourced from BJTechNews.org.

$strUser = "contoso.com\domain_join_user"
$strDomain = "contoso.com"
$strPassword = ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force
$Credentials = New-Object System.Management.Automation.PsCredential $strUser, $strPassword
$strOU = "CN=Computers,DC=contoso,DC=com" Add-computer -DomainName $strDomain -Credential $Credentials

Copy the script above into a new notepad file and edit it to match your environment configuration. Save it as domainjoin.ps1 in the location: \\WDS01\DeploymentShare$\Applications\_scripts.

Configure the Task Sequence

Go to Deployment Workbench > Deployment Share > Task Sequences.
Right click on Deploy - Reference W101607 and select Properties.
Navigate to State Restore > Windows Update (Pre-Application Installation).
On the Options tab of the Windows Update (Pre-Application Installation) action, uncheck the Disable this step. Do the same for the Windows Update (Post-Application Installation) action below the Install Applications action.
Select the Install Applications action, and click the Remove button at the top of the Task Sequence actions view.
Navigate to State Restore > Recover From Domain.
Click on the Add button at the top of the Task Sequence actions view and go to General > Run PowerShell Script, click to add the action.
In the Properties tab of the action just created enter: Script - Domain Join in the Name field.
In the Properties tab of the action now enter: %deployroot%\Applications\_scripts\domainjoin.ps1 in the PowerShell script field.
Click Apply to save the changes.
Go to the OS Info tab of the main Task Sequence window and click Edit Unattend.xml - this will create a catalogue file and may take some time.
When the catalogue has been created, the Windows System Image Manager will open.
Navigate to 4 specialize > amd64_Microsoft-Windows-Shell-Setup__neutral_31bf3856ad364e35_nonSxS.
Select CopyProfile in the Properties window and change it to True.
Save the Unattend.xml by clicking the save icon. you may get a prompt about validation errors, these are save to ignore - click Yes.
Close the Windows System Image Manager and click OK to close the Task Sequence Properties window.

Testing the Task Sequence

Now we’re going to test the Task Sequence using a Virtual Machine. Open Hyper-V or your virtual machine software and create a VM with the specifications below:

2x vCPUs
4GB RAM
40GB minimum Hard Disk
Network Adaptor with access to the MDT and WSUS server.
The LiteTouch_x64.iso from the \\WDS01\DeploymentShare$\Boot folder added as a boot device.

Start the Virtual Machine and boot into the deployment environment from the LiteTouch_x64.iso.
Select the Deploy - Reference W101607 task sequence.
Enter VM-DEP1 as a Computer name.
In the Capture image section, select Do not capture an image of this computer.
Click Next to start the Task Sequence.
When the Task Sequence completes, the VM will shut down.
Boot the VM again and it should boot into a fully updated installation of Windows 10 1607.
Log in with a domain account. Microsoft Office 2016, Adobe Reader DC, VLC media player and Google Chrome should be installed, and the profile should be customised as you specified.

Optional Post Image Tasks

Consider what additional tasks you want to be performed after the image has been deployed. Third party anti-virus software is most likely best installed and updated after the main imaging process. You may have configuration tasks that are performed via Group Policy which could be moved to the Deploy Task Sequence and removed from Group Policy, speeding up boot and log in times.

Setting the Default Application Associations

You may want to set the default application associations for your reference image. You can do this a variety of way but here is how you can configure them as part of the Deploy Task Sequence.

Using the deployed image on your VM, go to Settings > System > Default apps.
Set the Default apps as required.
Open PowerShell as Administrator by clicking on the Windows button, typing “PowerShell” then right click on the PowerShell icon and select Run as Administrator.
In the PowerShell window type the following and press enter: Dism /Online /Export-DefaultAppAssociations:C:\AppAssoc.xml
After a few seconds you should see The operation completed successfully in the PowerShell window.
Navigate to C:\AppAssoc.xml.
Copy AppAssoc.xml to \\WDS01\DeploymentShare$\Applications\_scripts.
Open the Deployment Workbench and go to Deployment Share > Task Sequences.
Right click on the Task Sequence Deploy - Reference W101607 and select Properties.
Click on the Task Sequence tab and navigate to Postinstall > Configure.
Click the Add button at the top of the Task Sequence actions view and go to General > Run Command Line.
Enter Set Default App Associations in the Name field, and in the Command line field enter: Dism.exe /Image:%OSDisk%\ /Import-DefaultAppAssociations:%DEPLOYROOT%\Applications\_scripts\AppAssoc.xml
Click Apply to save the changes.
Run the Deploy Task Sequence and the default apps you specified should be configured.

Driver Management

Now that we’ve created a reference image and deployed it on to a VM, it’s time to prepare to roll the image out on to physical hardware, which means setting up drivers. There are a few ways to do this, but here I’ll show the method I’ve been using which has worked very well for a variety of manufactures and models of devices, all running Windows 10 1607 without issue. The first thing you’ll need to have is the model numbers for all the devices you want to roll out the image to. You can find this out by booting the device in to the deployment environment using either the LiteTouch_x64.iso boot disc or the network using PXE, here’s a previous post I wrote on how to set up PXE booting: PXE Booting for Microsoft Deployment Toolkit. When the device is booted into the deployment environment, press F8 to get a command prompt, and typing out the following command:

`1`	`wmic computersystem get model`

The output of the command is the model number you’ll need.

A Word on Obtaining Drivers

The next thing you’ll need is the actual driver files that are required by your devices. I would like to stress that you should only add drivers that Windows 10 does not install itself during deployment. I’ve found Windows 10 is very good at installing missing drivers from Windows Update, but it can take some time and I wouldn’t recommend it as a solution for a full roll out. Building the drivers into MDT makes the process much quicker. The find out what drivers you’ll need, deploy the reference image to each type of device you have and using Device Manager, see what’s missing. You can Check online for updates from Microsoft Update from the Update section in Settings which should find and install the relevant drivers, then you can check the Update History and see what you need to import into MDT. I would not advise adding the Drivers classification to WSUS as it will bloat the database and make it unmanageable.

To successfully import the drivers you’ll need the .inf files. Most large manufacturers (HP, Lenovo, Dell) do a decent job of providing drivers that can be extracted from an .exe and used in MDT, although there are always a few drivers for laptops especially that are .exe’s and can have costed me some time and sanity. You can save yourself a lot of time by using the Microsoft Update Catalog to search for and download the specific drivers that Microsoft Update installs, and import the downloaded .cab files into MDT. Now we have our drivers downloaded, we need to edit the Deployment Share’s customsettings.ini to tell it what driver folder to use for what model.

Go to the Deployment Workbench and right click on the Deployment Share, select Properties.
Go to the Rules tab in the Properties window.
Enter the following under the [Settings] section, and click Apply to save the changes:

[MODEL-NUMBER]
DriverGroup001=Windows 10 x64\Human-Readable-Model-Number
DriverSelectionProfile=nothing
OSDPrefix=PC

You’ll need to enter the above text for each model. Below is an example of my customsettings.ini for reference.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix

[HP 250 G5 Notebook PC]
DriverGroup001=Windows 10 x64\HP 250 G3
DriverSelectionProfile=nothing
OSDPrefix=HP

[80J2]
DriverGroup001=Windows 10 x64\Lenovo E50
DriverSelectionProfile=nothing
OSDPrefix=LEN

[Virtual Machine]
DriverGroup001=Virtual Machine
DriverSelectionProfile=nothing
OSDPrefix=VM

[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%
UserDataLocation=NONE
ComputerBackupLocation=\\SERVER-NAME\Deploy$\Captures
OSDComputerName=%OSDPrefix%-%SerialNumber%
...

In the Deployment Workbench, go to Deployment Share > Out-of-Box Drivers.
Right click and select New Folder, call the folder Windows 10 x64.
Right click on the Windows 10 x64 folder and select New Folder, call the folder a suitable name for the model of device you’ll be adding drivers for. For me I’ll use HP 250 G3.
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Graphics, Chipset, Bluetooth.
To import the drivers, right click on a driver type folder and select Import Drivers.
Enter the source directory of the drivers and check the Import drivers even if they are duplicates of an existing driver check box.
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder.
Repeat steps 8-10 for each driver type required.
Now we must configure the Deploy Task Sequence to use the rules in the customsettings.ini.
Go to Task Sequences and right click on the Deploy - Reference W101607 Task Sequence, select Properties.
On the Task Sequence tab, go to Initialization > Gather local only.
On the Properties tab, select Gather local data and process rules and enter customsettings.ini in the Rules file field.
Click Apply to save the changes.

Boot the physical device into the deployment environment and run the Deploy - Reference W101607 Task Sequence. After it completes, check Device Manager and all devices should be successfully installed.

Adding Drivers to the MDT Boot Image

It may be necessary to add drivers to the MDT Boot Image for devices such as storage or network adaptors, although with the current version of MDT (8443) and all the devices I’ve deployed thus far I’ve not had to do this, but for completeness here’s how to do it. First we need to determine if we need drivers installing:

Boot the device in question into the deployment environment and press F8 to bring up a command prompt.
Type ipconfig and if you have an ip address, you do not need to add network adaptor drivers
Now, type diskpart, and when diskpart has loaded, type list disk. If the local hard drive is listed, you do not need to add storage drivers.

Should you need to add drivers:

In the Deployment Workbench, go to Deployment Share > Out-of-Box Drivers.
Right click and select New Folder, call the folder WinPE x64.
Right click on the WinPE x64 folder and select New Folder, call the folder a suitable name for the model of device you’ll be adding drivers for. For this I’ll use HP 250 G3.
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Storage, Network.
To import the drivers, right click on a driver type folder and select Import Drivers.
Enter the source directory of the drivers and be sure to tick the Import drivers even if they are duplicates of an existing driver check box.
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder.
Repeat steps 8-10 for each driver type required.
Now we must create a Selection Profile for WinPE x64.
Go to Advanced Configuration > Selection Profiles.
Right click on Selection Profiles and select New Selection Profile.
Enter WinPE x64 as the Selection profile name.
In the folders list navigate to DS001:\ > Out-of-Box Drivers > WinPE x64 and check the box next to the folder.
Click Next > Next > Finish to complete the wizard.
Right click on the Deployment Share and select Properties.
Go to the Windows PE tab and change the Platform drop down menu to x64.
Go to the Drivers and Patches tab, and change the Selection profile drop down menu to WinPE x64.
Check that Include only drivers of the following types is selected and both Include all network drivers in the selection profile and Include all mass storage drivers in the selection profile are checked.
Click Apply to save the changes, click OK to close the Properties window.
Right click the Deployment Share and select Update Deployment Share.
Select Completely regenerate the boot images, and then Next. The boot images will be regenerated with the drivers included.
Click Finish to complete the wizard.

You’ll need to add the newly generated boot images to Windows Deployment Services for PXE booting:

Open Windows Deployment Services MMC.
Expand Servers > wds01.yourdomain > Boot Images.
Right click on the old boot image and remove it.
Right click in the empty boot image window, and select Add Boot Image.
Browse to E:\DeploymentShare\Boot\LiteTouchPE_x64.wim and click through to complete the wizard.

Boot your device via PXE and it should now have the network/storage drivers needed to carry out the Deploy Task Sequence.

Securing the Deployment Environment

If all has worked then you now have a fully functioning deployment solution. At this point I would suggest securing your Deployment Environment by removing the login details from bootstrap.ini that we added in the very first post.

In Deployment Workbench, right click the deployment share and select Properties.
Select the Rules tab and click the Edit Bootstrap.ini button.
Remove the following from the Bootstrap.ini

1
2
3

UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd

Close and Save the Bootstrap.ini

This concludes the ‘real world’ deployment phase of the walk through. In this post I’ve talked about deploying the reference image, joining the client to a domain, performing additional post-imaging tasks, and installing drivers required for multiple device models.

If you have any questions or comments, please leave them below.

-Mike

Building a Windows 10 1607 Reference Image with Microsoft Deployment Toolkit 8443

Fri, 20 Jan 2017 22:38:01 +0000

Following on from my previous post (Getting Started With Microsoft Deployment Toolkit 8443 and Windows 10 1607), I’ll be continuing my series of deploying Windows 10 with Microsoft Deployment Toolkit.

Update 2017-05-02: Please note that this post is also relevant to Windows 10 1703 (Creators Update) with a few minor changes, which I’ve posted about here.

In this post I’ll be building a task sequence to create a reference image that would be suitable for a real world deployment on new devices or performing a ‘wipe and load’ on existing devices. I’ll also touch on how to silently install common Microsoft and non-Microsoft products and customising installs.

Prerequisites

In this series of posts, here’s what I’ll be using on my demo network:

Active Directory Domain Controller running on Windows Server 2016 Standard - DC01.
An installation of Microsoft Deployment Toolkit 8443 configured as per my previous post, running on Windows Server 2016 Standard - WDS01.
A WSUS server (my previous post: Installing WSUS from scratch!) running on Windows Server 2016 Standard - WSUS01.
A Hyper-V virtual machine or equivalent - VM01.
Office 2010, 2013 or 2016 installation files. For this demo I’ll be using Office 2016, but the method is the same for both 2010 and 2013.
Adobe Reader DC offline/full installation files.
VLC media player installer.
Google Chrome offline installer.

If you’ve followed my previous post, your Microsoft Deployment Toolkit installation should have Windows 10 1607 imported as an Operating System, KB3193494 imported as a Package, and a Selection Profile for Windows 10 1607 x64 packages created.

Importing Applications - Microsoft Office 2016

Microsoft Office integrates into MDT very well, let’s take a look:

Go to Deployment Workbench > Deployment Share > Applications.
Right click on Applications and select New Application.
In the New Application Wizard, choose Application with source files.
Give the application the name: Microsoft Office 2016.
Enter the Source directory of the installation files.
Enter the Destination directory: Microsoft Office 2016.
For the Command line enter anything - we’ll revisit this soon.
On the summary page, click Next and after the files are copied click Finish to complete the wizard.

Configure the Application - Microsoft Office 2016

Right click on Microsoft Office 2016, go to the Office Products Tab.
Choose the desired Office Product to Install from the drop down menu.
Check the desired Office language.
To activate Office via KMS leave the Product Key option unchecked.
Check the Customer name option and enter the desired information.
Check the Display level option and select None in the drop down menu.
Check the Accept EULA option.
Check the Always suppress reboot option.
Click Apply.
Go to the Details tab and the Quiet install command should now read: setup.exe /config proplus.ww\config.xml

Microsoft Office is now set up to be installed in an automated fashion by a Task Sequence. If you wish to customise the installation to a greater degree, the Office Customization Tool can be launched from the Office Products tab and you can also add extra Office applications and language packs via the Add button on the same tab.

Importing Applications - Adobe Reader DC

As this is a “real world” demo on creating a reference image, I want to walk through adding common non-Microsoft products. Here we’ll import Adobe Reader DC, VLC media player and Google Chrome.

Go to Deployment Workbench > Deployment Share > Applications.
Right click on Applications and select New Application.
In the New Application Wizard, choose Application with source files.
Give the application the name: Adobe Reader DC.
Enter the Source directory of the Adobe Reader installer file. MDT will copy all files and folders from the specified directory.
Enter the Destination directory: Adobe Reader DC.
For the Command line enter: [adobe reader installer name].exe /sAll.
On the summary page, click Next and after the files are copied click Finish to complete the wizard.

Repeat these steps for other products that you require. The quiet install command that you’ll need can be found in the command line help for the installer or online. Following the same steps for Adobe Reader DC we’ll add VLC media player. The command line will be: vlc-2.2.4-win32.exe /S

Now we’ll add Google Chrome, the command line will be: msiexec /I googlechromestandaloneenterprise64.msi /qn

If you need to customise the Adobe Reader DC installation to a greater degree then you may want to download the Adobe Customisation Wizard, which will enable you to create a transform file which you can call using the command line: [adobe reader installer name\.exe /msi TRANSFORMS="%DEPLOYROOT%\Applications\Adobe Reader DC\TRANSFORM-FILE.mst" /qn

Create the Task Sequence

These steps will create a Task Sequence that will:

Format the hard disk.
Install Windows 10 1607 with KB3193494 included.
Check for and install updates from the WSUS server.
Install Adobe Reader DC, Office 2016, VLC Media Player and Google Chrome.
Check for and install updates from WSUS once again.
Suspend the Task Sequence for user profile customisation.
Capture the image and copy to the Deployment Share.

Go to Deployment Workbench > Deployment Share > Task Sequences.
Right click on Task Sequences and select New task sequence.
Enter the ID for the Task Sequence: REF-W101607.
Enter the name for the Task Sequence: Build - Reference W101607.
Select the Standard Client Task Sequence template.
Select Windows 10 Enterprise 1607 x64 as the Operating System.
Select Do not specify a product key at this time.
Enter an Organization name.
Select Do not specify an Administrator password at this time.
Click Next > Next > Finish to complete the wizard.

Configure the Task Sequence

Go to Deployment Workbench > Deployment Share > Task Sequences.
Right click on Build - Reference W101607 and select Properties.
On the Task Sequence tab navigate to Preinstall > Apply Patches.
On the Properties tab of the Apply Patches action, change the Selection profile to Windows 10 1607 x64.
Navigate to State Restore > Windows Update (Pre-Application Installation).
On the Options tab of the Windows Update (Pre-Application Installation) action, uncheck Disable this step.
Repeat step 6 for the Windows Update (Post-Application Installation) action below the Install Applications action.
Select the Install Applications action.
In the Properties tab select Install a single application, then click the Browse button and select Microsoft Office 2016 from the list.
Rename the Install Applications action to Install - Microsoft Office 2016.
Copy and Paste the Install - Microsoft Office 2016 action with either CTRL + C then CTRL + P or by right clicking and selecting copy and then paste.
Select the top copy of the Install - Microsoft Office 2016 action.
In the Properties tab of the copied action, click the Browse button and select Adobe Reader DC from the list.
Rename the copied action to Install - Adobe Reader DC.
Repeat steps 11 - 14 for VLC and Google Chrome.
Select the Custom Tasks group under the Windows Update (Post-Application Installation) action.
In the Properties tab, change the name to Suspend for profile.
Click on the Add button at the top of the Task Sequence actions view and go to General > Restart computer, click to add the action.
Click on Add once again and go to General > Run Command Line.
On the Properties tab of the action just created, in the Command line field enter: cscript.exe "%SCRIPTROOT%\LTISuspend.wsf
In the Name field enter Suspend.
Make a copy of the previous Restart computer action and using the Up and Down buttons at the top of the Task Sequence actions view, move it below the Suspend action.
Click Apply.
Go to the OS Info tab of the main Task Sequence window and click Edit Unattend.xml - this will create a catalogue file and may take some time.
When the catalogue has been created, the Windows System Image Manager will open.
Navigate to 7 oobeSystem > Shell Setup_neutral > OOBE.
Select ProtectyourPC in the OOBE Properties window and change 1 to 3.
Save the Unattend.xml by clicking the Save 💾 icon. You may get a prompt about validation errors, these are safe to ignore - click Yes.
Close the Windows System Image Manager and click OK to close the Task Sequence Properties window.

Testing the Task Sequence

Now we’re going to test the Task Sequence using a Virtual Machine. Open Hyper-V or your virtual machine software and create a VM with the following specifications:

2x vCPUs
4GB RAM
40GB minimum Hard Disk
Network Adaptor with access to the MDT and WSUS server.
The LiteTouch_x64.iso from the \\WDS01\DeploymentShare$\Boot folder added as a boot device.

Start the Virtual Machine and boot into the deployment environment from the LiteTouch_x64.iso.
Select the Build - Reference W101607 task sequence.
Enter VM-REF1 as a Computer name.
In the Capture image section, select Capture an image of this reference computer. The location and file name should be set automatically from the Rules.ini file in the deployment share, which should be configured as in my previous post.
Click Next to start the Task Sequence.
The task sequence should stop when it reaches the Suspend action. This is when you should do profile customisation, such as Start Menu layout and initial application setup.
When you’re ready to continue the task sequence, double click the Resume Task Sequence icon on the desktop.
The VM will boot into the deployment environment and capture the image to \\WDS01\DeploymentShare$\Captures.
When the VM shuts down, the Task Sequence is complete.

Importing the Reference Image

If the Task Sequence has run successfully you should now have a reference image. We will now import it into the Deployment Share as an Operating System in order to deploy it.

Go to Deployment Workbench > Deployment Share > Operating Systems.
Right click on Operating Systems and select Import Operating System.
Select Custom image file.
Browse to \\WDS01\DeploymentShare$\Captures and select the Reference Image to import.
Select Setup files are not needed.
Enter the Destination directory name: REF-W101607.
Click Next > Finish to import the image and complete the wizard.
You’ll notice that the image you just imported has a long unwieldy name. Right click on the image, select Rename and enter: REF-W101607.

The reference image is now ready to be deployed on to physical devices, which I cover in the next post (Deploying a Windows 10 1607 Reference Image with Microsoft Deployment Toolkit 8443) along with driver management, domain joining and other post-imaging tasks. If you have any questions or comments, please leave them below.

-Mike

Windows 10 1607 (Anniversary Update) opens msn.com at login and how to stop it.

Thu, 12 Jan 2017 22:01:34 +0000

I thought about trying to find a better name for this post and this issue, but this is all I could come up with.

Update 2017-10-16: A few people have contacted me and made me aware that doing the reg hack below can prevent users from using Microsoft Office Clipart, so you should be aware of that before proceeding. Additionally, I’ve found that with Windows 10 1703 (Creators Update), allowing access to http://www.msftconnecttest.com/redirect through your firewall/proxy will achieve the same thing without the reg hack and without preventing access to Microsoft Office Clipart. Please note though, it does not work with 1607.

Original Post ANYWAY, I finally tracked down how to stop Windows 10 1607 (Anniversary Update) from opening the default browser with msn.com. There are no startup or login registry entries, Group Policy settings, Scheduled Tasks, or even programs in the Start Menu startup folder. This is *something* that Windows is doing itself. I’ve only encountered this issue on corporate networks, not on my home network, so I knew that some sort of authentication/proxy/filtering/firewall thing. I’ve also only had this issue with Windows 10 1607 (Anniversary Update), not 1511 (November Update) or 1507 (RTM).

It seems that Windows 10 is probing the network to get out to the internet, hitting some sort of issue (I’m guessing that it’s authentication in my case) and then opening up the default browser and browsing to a Microsoft owned address that results in a redirect to http://www.msn.com. In my case no authentication dialogue box pops up, it just browses to the site and appears to be happy with that. Weird. If it were only happening to “Admin” users I wouldn’t worry about it, but it happens to everyone! So, although not a cause for major concern or enough to halt my roll out of Windows 10 1607, I still wanted to fix it, if possible.

After some research it appears a similar issue to this occurred with Windows 8. I never had this issue during my roll out of Windows 8 but the resolution appears to work for Windows 10 1607 as well. At this stage I don’t know if making this change causes any unforeseen problems, but I’ll add to this post if I see anything. Here’s how to prevent it. Using the registry editor, navigate to the location below, and change the “1” (enabled) to a “0” (disabled).

`1`	`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\EnableActiveProbing`

This should stop the browser from opening at login but Internet access should still be available. I hope this helps. If you’ve already done this and it’s caused another issue, please let me know in the comments or tweet me! You’ll probably want to roll this out to your Windows 10 clients, of course you can do it via Group Policy but as it’s a one time setting I would suggest adding it to the Task Sequence that builds your reference image.

Adding the registry change to Group Policy

Open Group Policy Management
Navigate to Group Policy Objects
Right click and Create or edit your Group Policy for your Windows 10 Clients
Navigate to Computer Configuration > Preferences > Windows Settings > Registry
Right click and go to New > Registry Item
Under Key Path enter SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet
Under Value name enter EnableActiveProbing
The Value type should be REG_DWORD
The Value data should be set to 00000000 - that’s six zeros for a Hexadecimal Base or you can just enter one zero for Decimal Base.
Click OK to save the changes.
If you created a new Group Policy Object, you will need to link it to an OU that contains the clients you want the GPO to affect. To do this right click the OU and select Link an existing Group Policy… and then select the Group Policy you created earlier.

Adding the registry change to a Task Sequence

Open Notepad and paste the following into it:

Windows Registry Editor Version 5.00
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet]
"EnableActiveProbing"=dword:00000000

Save the file with any name you like, but it must have the extension .reg
Copy the .reg file to your Deployment server. It needs to be accessible by the Task Sequence, so I put mine in E:\DeploymentShare\Applications\
In the Task Sequence, you’ll want to add it before the Windows Update (Pre-Application Installation) item, so select that item first.
Click the Add button at the top of the sequence, and go to General > Run Command Line.
Select the new Run Command Line item and click the Up button at the top of the sequence to move it above the Windows Update (Pre-Application Installation) item.
On the right hand side of the window, under Name, enter whatever you want, I called mine cmd - disable active probing
Under Command Line enter REG IMPORT Z:\Applications\ActiveProbing.reg
Click OK to save and close the Task Sequence and you’re done!

When you run the Task Sequence to create a reference image, the registry will be edited and during your build phase you won’t get any browser windows opening on login.

If you have any questions or comments, please leave them below.

-Mike

Getting Started With Microsoft Deployment Toolkit 8443 and Windows 10 1607/1703

Sat, 26 Nov 2016 19:05:25 +0000

For this post the demo network consists of an Active Directory Domain Controller (DC01), a WSUS server (WSUS01) - here’s a previous post on installing WSUS, a server that will have Microsoft Deployment Toolkit installed (WDS01) and a blank Hyper-V Virtual Machine for creating the reference image.

Update 2017-05-02: Please note that this post is also relevant to building Windows 10 1703 (Creators Update) images. I’ve posted about the differences here.

The WDS01 server is a Hyper-V VM configured like so:

2 vCPUs
4GB RAM
C:\ for Windows
E:\ for MDT

We’ll be using Microsoft Deployment Toolkit (MDT) version 8443, which at the time of writing is a recent release, after a long time of being at version 2013 Update 2. Microsoft explain in this blog post about removal of the year/update naming scheme and development going forward - essentially, it’s not going away, they will still keep developing it. Software we’ll be using:

Windows 10 1607 Assessment and Deployment Kit (ADK)
Microsoft Deployment Toolkit (8443)
Windows 10 1607 x64 install files
Cumulative update for Windows 10 Version 1607: September 20, 2016 - If using a WSUS server
VLC Media Player (for software install demo)

Install

First we’ll install the Windows 10 1607 ADK. The setup will need to download additional files so it may take some time depending on your internet connection. On the Select the features you want to install screen select:

Deployment Tools
Windows Preinstallation Environment (Windows PE)
Imaging And Configuration Designer (ICD)
Configuration Designer
User State Migration Tool (USMT)

Now install MDT by running the setup file downloaded earlier, there is no specific configuration during the install wizard.

Open the Deployment Workbench from the Start Menu.
Right click on Deployment Shares.
Select New Deployment Share.
Enter the path for the Deployment Share: E:\DeploymentShare.
Enter the Share name: DeploymentShare$.
Give the share a descriptive name.
On the Options screen, accept the defaults as you can change them later.
Complete the wizard to create the share.

Now we’re going to add Windows 10 1607 as an Operating System to deploy.

Mount the Windows 10 1607 .iso in File Explorer.
Go to Deployment Workbench > Operating Systems.
Right click and select Import Operating System.
In the wizard, select Full set of source files and then enter the root of the mounted .iso as the Source directory.
For the destination directory name enter Windows 10 Enterprise 1607 x64 and complete the wizard.
Go to the Operating Systems node again and rename the OS you just added to Windows 10 Enterprise 1607 x64.

Importing Packages & Creating Selection Profiles

We will now import the Cumulative Update for Windows 10 Version 1607 (KB3193494) into MDT, so that it can be installed with the OS.

Go to Deployment Workbench > Packages.
Create a folder named Windows 10 1607 x64.
Right click on the folder and select Import OS Packages and go through the wizard to add the package. The package must be in a folder by itself.

Now we will create a selection profile so that the package is only installed for Windows 10 1607 x64.

Expand the Advanced Configuration node.
Right click on Selection Profiles and select New Selection Profile.
Name it Windows 10 1607 x64.
On the Folders page, tick the Windows 10 1607 x64 folder under Packages and complete the wizard.

Importing Applications

We’ll now import VLC Media Player, so it can be installed as part of the reference image.

In Deployment Workbench right click on Applications and select New Application.
Select Application with source files, then on the Details page, enter VLC Player as the Application Name.
On the Source page, enter the location of the VLC executable, it will need to be in a folder by itself as the wizard will copy all files in the location specified.
Enter the name: VLC for the directory.
On the Command Details page enter the name of the VLC executable with the /S option - this will install VLC silently without user interaction.
Complete the wizard.
In the Applications node, rename the VLC app to Install - VLC.

Create a Task Sequence

We’ll now create a Task Sequence to build a fully updated Windows 10 1607 x64 reference image, with VLC installed.

In Deployment Workbench, go to Task Sequences.
Right click and select New Task Sequence.
For the ID enter: B-W10-1607.
Name it Build Windows 10 1607.
Select Standard Client Task Sequence.
Select the Operating System Windows 10 1607 x64.
Do not specify a product key at this time.
Enter an Organization name.
Do not specify an Administrator password at this time.
Complete the wizard.

Configure the Task Sequence

Right click on the Task Sequence just created and select Properties.
Go to the OS Info tab and click Edit Unattend.xml. It will take sometime to generate the catalog.
When the Unattend.xml opens, go to 7 oobesystem > amd64_Microsoft-Windows-Shell-Setup__neutral > OOBE.
Change the ProtectYourPC setting to 3. This will prevent the image from randomly checking for updates whilst it is being built.
Save the Unattend.xml, you can safely ignore an warnings.
Go to the Task Sequence tab on the Properties window of the Task Sequence.
Expand the Preinstall folder, and select the Apply Patches item.
Change the Selection Profile to Windows 10 1607 x64.
Go to the State Restore folder and select Windows Update (Pre-Application Installation).
On the right side of the Properties window, go to the Options tab.
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation).
Go to the Install Applications item.
In the right side of the Properties box, select the Install a single application option and click the Browse… button.
Select Install - VLC and change the name Install Applications to Install - VLC.
Click Apply and close the Task Sequence.

Configure Deployment Rules

Before we create the boot media we must configure several settings that will effect how the boot media will connect to the deployment environment.

In Deployment Workbench, right click the deployment share and select Properties.
On the Windows PE tab, select the Drivers and Patches sub-tab.
Under the Selection Profile drop down menu, change it to All Drivers.
Select the Platform drop down menu and select x64 and again change the Selection Profile to All Drivers.

Now we must create an Active Directory account for MDT to use and give it permissions to the Deployment Share.

Go to Active Directory Users and Computers.
Create a user called mdt_admin.
On WDS01 (where the deployment share is hosted), give mdt_admin Full Control share permissions and Full Control permissions to all the files and folders under the deployment share.

We will now configure the Rules and Bootstrap.ini. The settings below enable auto log in and skip the welcome screen.

In Deployment Workbench, right click the deployment share and select Properties.
Select the Rules tab and click the Edit Bootstrap.ini button.
Add the settings below to the Bootstrap.ini.
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\WDS01\DeploymentShare$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

On the Rules tab of the Deployment Share properties window, add the settings below. A lot of the settings are specific to my demo environment such as my location in the world. The [Virtual Machine] section near the top is one example of how to manage drivers and auto fill computer names for when deploying images based on the model reported by Windows. I’ll cover this in more detail a future post.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix
 
[Virtual Machine]
DriverGroup001=Virtual Machine
DriverSelectionProfile=nothing
OSDPrefix=VM
 
[Default]
_SMSTSORGNAME=Mike Galvin | OSD Solutions
_SMSTSPackageName=%TaskSequenceName%
UserDataLocation=NONE
ComputerBackupLocation=\\WDS01\DeploymentShare$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date)#.wim
OSInstall=Y
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
BitsPerPel=32
VRefresh=60
XResolution=1
YResolution=1
WSUSServer=http://wsus01:8530
SkipAdminPassword=YES
SkipCapture=NO
SkipRoles=YES
SkipProductKey=YES
SkipUserData=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
OSDComputerName=%OSDPrefix%-%SerialNumber%

Creating Boot Media

Now we’ll create the boot media.

In Deployment Workbench, right click on the Deployment Share.
Select Update Deployment Share.
Select Completely regenerate the boot images.
Complete the wizard. It will take some time to create the boot images.

Testing Boot Media

To test the boot media, copy the LiteTouchPE_x64.iso from \\WDS01\DeploymentShare$\Boot to a location where the new Hyper-V VM will be able to access it. Set the configuration of the VM as such:

2 vCPUs
4GB RAM
NIC

Add the LiteTouchPE_x64.iso as a boot device. Start the VM and it should boot from the iso into the MDT environment, which is using Windows PE. You should be presented with a wizard and the Task Sequence you created earlier. Select it and click Next. The Computer Name should be already filled in with something like VM-1234-1234…etc. Replace it with vm-ref-w10. Select Capture an image of this reference computer. The Task Sequence should now run, install Windows 10, update from the WSUS server, install VLC and then capture the image. When this process completes the VM will be shutdown and a file named B-W10-1607_YEAR_MONTH_DAY.wim will be in \\WDS01\DeploymentShare$\Captures. You now have a functioning MDT server and a Task Sequence to build and capture a reference image with Windows 10 1607. I will post in future on how to deploy the captured image, manage drivers, and deploy common application like Microsoft Office 2016. Hopefully for now, this post has given you what you need to get started with MDT and deploying Windows 10.

If you have any questions or comments, please leave them below.

-Mike

Stuck Windows Updates From Windows Server Update Services (WSUS) On Windows 10 1607/Windows Server 2016

Tue, 08 Nov 2016 19:53:50 +0000

If you’ve installed a fresh install of Windows 10 1607/Windows Server 2016 recently, you may have experienced a problem when it tries to download and install updates from your local WSUS server - specifically, it doesn’t, it gets stuck. You’ve tired rebooting, stopping the BITS and WU services, deleting %systemroot%\SoftwareDistribution but nothing seems to work. Both Windows 10 1607 and Windows Server 2016 require a cumulative update that fixes this specific issue. You can of course just download the update off Microsoft’s WU servers but if you’re using MDT then you can download the update separately, and add it to MDT to push out during the install phase of the Task Sequence. You can use any Windows 10/Windows Server 2016 Cumulative Update released for Windows 10 1607, the more recent the better.

Update 16/10/2017: If you’re experiencing stuck updates (or incredibly slow during a Task Sequence) with Windows Server 2016 but not Windows 10 1607 and they are both serviced by the same WSUS server, the cause may be due to Express Updates being enabled.

Update 25/04/2017: The previous CU I listed here is now gone from the Update Catalog. Here is the most recent one I’ve tested: https://www.catalog.update.microsoft.com/Search.aspx?q=kb4015217. As before the CU is for both Windows 10 1607 and Windows Server 2016 so you don’t need to download both versions.

KB4015217 info from Microsoft - https://support.microsoft.com/en-us/help/4015217/windows-10-update-kb4015217

Original Post To build it into your MDT install sequence, download the update from the Microsoft Update Catalog and follow the steps below. Please note that the update for Windows 10 x64 and Windows Server 2016 is the same - you only need to download one of them.

Import The Update

Go to Deployment Workbench and create two new folders under the Packages node, one for Windows 10 1607 x64 and one for Windows Server 2016.
Right click on the Windows 10 1607 x64 folder you just created and select Import OS Packages.
Browse to the location of the update (you will need to put it in a folder by itself) and click Next through the wizard and wait for the Update to be imported.
As this update is the same for both Windows 10 1607 x64 and for Windows Server 2016, you can right click on the imported package and paste it into the Windows Server 2016 folder.

Create A Selection Profile

In Deployment Workbench, go to the Advanced Configuration node and expand it, then go to the Selection Profiles.
Right click and create a new Selection Profile. Name it Windows 10 1607 x64, tick the Windows 10 1607 x64 folder under Packages and click Next through the rest of the wizard.
Repeat the steps above for a Windows Server 2016 Selection Profile choosing the Windows Server 2016 folder.

Enable The Selection Profile In A Task Sequence

Create a Standard Task Sequence to install Windows 10 1607 x64.
Right click on the Task Sequence, go to Properties, go to the Task Sequence tab.
Expand the Preinstall node, and select the Apply Patches item. In the Properties tab on the right, under Selection profile, change it to Windows 10 1607 x64.

The Task Sequence will now deploy Windows 10 1607 x64 and install the Cumulative Update as part of the build.

If you have any questions or comments, please leave them below.

-Mike

Windows 10 1607 Anniversary Update on gal.vin

Windows 10 1607/1703 Start Menu Customisation - Update

Deploying a Windows 10 1607 Reference Image with Microsoft Deployment Toolkit 8443

Creating the Deployment Task

Configure the Task Sequence

Testing the Task Sequence

Optional Post Image Tasks

Setting the Default Application Associations

Driver Management

A Word on Obtaining Drivers

Adding Drivers to the MDT Boot Image

Securing the Deployment Environment

Building a Windows 10 1607 Reference Image with Microsoft Deployment Toolkit 8443

Prerequisites

Importing Applications - Microsoft Office 2016

Configure the Application - Microsoft Office 2016

Importing Applications - Adobe Reader DC

Create the Task Sequence

Configure the Task Sequence

Testing the Task Sequence

Importing the Reference Image

Windows 10 1607 (Anniversary Update) opens msn.com at login and how to stop it.

Adding the registry change to Group Policy

Adding the registry change to a Task Sequence

Getting Started With Microsoft Deployment Toolkit 8443 and Windows 10 1607/1703

Install

Create the Deployment Share and an Import Operating System

Importing Packages & Creating Selection Profiles

Importing Applications

Create a Task Sequence

Configure the Task Sequence

Configure Deployment Rules

Creating Boot Media

Testing Boot Media

Stuck Windows Updates From Windows Server Update Services (WSUS) On Windows 10 1607/Windows Server 2016

Import The Update

Create A Selection Profile

Enable The Selection Profile In A Task Sequence